CVE-2026-11686

LowCVSS 3.1/10Last modified Jul 23, 2026

Description

Insufficient validation of untrusted input in Dawn in Google Chrome on macOS prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Jun 9, 2026
Last modified
Jul 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1168605.3Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.TCVE-2026-1168617.5Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions.CVE-2026-1168627.5Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions.CVE-2026-1168639.6Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site Request Forgery.This isCVE-2026-1168647.2Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions.CVE-2026-1168657.2Editor PHP Object Injection in Zippy <= 1.7.0 versions.CVE-2026-1168668.8Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions.CVE-2026-1168678.8Contributor PHP Object Injection in Dynamic QR Code &#8211; generator <= 1.0.1 versions.CVE-2026-1168688.8Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions.CVE-2026-1168697.2Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions.CVE-2026-116878.8Use after free in Dawn in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via CVE-2026-1168708.7In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in a token issued from
CVE-2026-11686: Low severity, CVSS 3.1 | Vulnix